Big Business Fails to Influence Privacy Legislation in Maine

While privacy legislation within the U.S. is relatively lackluster when compared to many other countries around the world, there are a handful of states within the country that have enacted laws that impose strict privacy requirements against retail businesses, telecommunications providers, social media companies, etc. To this point, Maine created one of the most stringent privacy laws in the country when legislators within the state passed Me. Rev. Stat. tit. 1 § 14-A § 541- 542 in 2019, with the aim of providing the state’s millions of residents with more digital and online privacy.

Nevertheless, in contrast to many other U.S. states that have passed similar laws in the past few years, including the Virginia Consumer Data Protection Act (VCDPA) and the Colorado Privacy Act, among others, several of the nation’s top telecommunications companies filed a lawsuit against the State of Maine, on the grounds that the law violated their First Amendment rights “by unconstitutionally restricting how they use or disclose customer personal information.” For context, the provisions of Maine’s ISP privacy law give citizens the right to opt-out of the collection, processing, retention, and sale of their personal information.

Internet service providers and privacy

As internet access continues to play a pivotal role in the everyday lives of consumers around the globe, the service providers that enable these consumers to access the internet are able to collect a trove of personal information in doing so. For example, the average consumer looking to access the internet via their smartphone, computer, or tablet will need to create an account with a particular service provider. Subsequently, they will need to provide this service provider in question with their first and last name, address, email address, and financial account information, among other pertinent details concerning their personal lives. However, in spite of the huge emphasis placed on internet accessibility in our current society, there are few laws that govern internet service providers.

For this reason, the Maine state legislature took steps in 2019 to protect the personal privacy of the citizens within their state as it relates to the privacy of their personal data. Under the law, various forms of information are legally protected, including the precise geolocation information of customers, their web browsing history, and their mobile application usage, just to name a few. On top of this, the law also requires internet service providers to provide Maine residents with “a clear, conspicuous and nondeceptive notice at the point of sale and on the provider’s publicly accessible website of the provider’s obligations and a customer’s rights” when rendering services to a given customer.

Business dilemmas

On the other hand, the current segmented and disjointed nature of data privacy legislation around the U.S. can make it difficult for certain businesses to maintain their profit margins while simultaneously complying with a web of different privacy laws. For context, very few other U.S. states have passed any form of privacy legislation as of 2022, meaning that internet service providers serving customers within Maine will effectively have to alter their typical business practices in order to avoid violating the law. Nonetheless, the notion that Maine’s internet privacy law was infringing on the first amendment rights of internet service providers that conduct business within the state of Maine was flawed at best.

Likewise, these sentiments were echoed by a judge that rejected this premise in 2020 when Maine’s internet privacy law first went into effect. However, this was by no means the end of the road for the internet service providers involved in the case, as Maine’s current attorney general Aaron Frey was quoted as saying “While there will be more litigation, this initial ruling is a huge victory for Maine consumers and for our state’s efforts to take appropriate measures to protect their privacy.” Despite these legal realities, however, the internet service provider involved in the case ultimately chose to drop their lawsuit earlier this month, as Frey was quoted yet again as saying “Maine’s Legislature wisely sought to protect Maine residents by restricting the disclosure and use of their most private and personal information.”

While the victory that the state of Maine won regarding their landmark internet privacy law earlier this month has failed to make national headlines, the impact of the decision will undoubtedly influence the enactment of similar legislation around other the country. In this way, improved data privacy legislation within the U.S. is an all but inevitable reality, irrespective of whether such legislation comes at the state or federal level. For this reason, internet service providers, as well as other businesses that collect personal information from consumers, must begin coming to terms with the fact that the day of collecting such information without some modicum of regulation are likely coming to an end in the near future.